How many times do you plan on posting this?
Bypassing Antivirus with Ten Lines of Code
21–30 of 100 posts
Re: Bypassing Antivirus with Ten Lines of Code
#22So what's this line all about: ((void(*)())exec)(); Type cast a void pointer to a void pointer, execute the result, then execute the result of that? Or ... Can anyone explain what's going on here?
Without reading the article: it looks like it casts exec to a function pointer with void return type and no arguments, and calls it.
(Disclaimer: I'm paid for writing Java :( )
Re: Bypassing Antivirus with Ten Lines of Code
#23So what's this line all about: ((void(*)())exec)(); Type cast a void pointer to a void pointer, execute the result, then execute the result of that? Or ... Can anyone explain what's going on here?
Almost. It's casting exec to a pointer to a function that "returns" void and takes no arguments and then calling the function. Search for "C right-left rule" (without quotes) to see some hints on how to read complex declarations (mostly applies to casting too). I like http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html
Re: Bypassing Antivirus with Ten Lines of Code
#24So what's this line all about: ((void(*)())exec)(); Type cast a void pointer to a void pointer, execute the result, then execute the result of that? Or ... Can anyone explain what's going on here?
It's actually a cast to a function pointer with signature: void exec(). The trailing brackets () then make the program call the function.
Re: Bypassing Antivirus with Ten Lines of Code
#25Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.
No, this is not surprising at all. It's impossible to determine whether software is malicious or not (Rice's theorem). Antivirus software only reliably detects code that is identical to known malicious software.
That's not true - there's heurystic analysis techniques, generic signature detection etc. Of course they may not meet your definition of "reliably"
Re: Bypassing Antivirus with Ten Lines of Code
#26So what's this line all about: ((void(*)())exec)(); Type cast a void pointer to a void pointer, execute the result, then execute the result of that? Or ... Can anyone explain what's going on here?
This is a common way of executing shellcode in a PoC.
Exec (before the cast) points to memory containing the shellcode data.
To actually start executing the shellcode, you just need to somehow cause the program counter to point to the address of the shellcode.
An easy way to change the program counter is by calling a function ... which is what this line does.
Read this as "cast exec to a pointer to a function that takes zero arguments and returns void and call the function with no arguments."
This is the same as:
typedef void (*some_func)();
some_func func = (some_func)exec;
func();
Re: Bypassing Antivirus with Ten Lines of Code
#27It'll work until a virus scanner company distributes a virus definition file containing a signature of your offending code.
And then you change the code a tiny bit and the signature doesn't catch it anymore.
Re: Bypassing Antivirus with Ten Lines of Code
#28I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…
That is an example of a mandatory access control (MAC) framework[1]. SELinux[1] is a MAC for linux systems and is very effective if the user doesn't disable it due to frustrations over false positives or due to true positives that are viewed by the user as false.
OSX has discretionary access control, which can be configured to be a full MAC[3].
Starting in OS X v10.5, the kernel includes an implementation of the TrustedBSD Mandatory Access Control (MAC) framework. A formal requirements language suitable for third-party developer use was added in OS X v10.7. Mandatory access control, also known as sandboxing, is discussed in Sandboxing and the Mandatory Access Control Framework.[4]
[1] https://en.wikipedia.org/wiki/Mandatory_access_control
[2] https://en.wikipedia.org/wiki/Security-Enhanced_Linuxhttps:/...
[3] http://sysdev.me/trusted-bsd-in-osx/
[4] https://developer.apple.com/library/mac/documentation/Securi...
Re: Bypassing Antivirus with Ten Lines of Code
#29It'll work until a virus scanner company distributes a virus definition file containing a signature of your offending code.
And then you change the code a tiny bit and the signature doesn't catch it anymore.
> change the code a tiny bit
How? That's the principle that everyone's missing! Sure, you can change the code a bit, but the millions of copies of your worm out there already can't magically change themselves after AV vendors update their blacklist. Sure, you can make a polymorphic worm, but even after mutation, your worm still probably has common patterns that blacklist makers can catch.
I'm a fan of proactive, not reactive security --- but let's not pretend that what AV vendors are doing is completely bogus.
You also have to keep in mind that blacklists are behavior heuristics are more suited to a bygone age --- one of low-bandwidth, sporadic connections and floppy disks that could be infected with trojans. Nowadays, we're more worried about drive-by 0day flash exploits from ad networks than about infected, self-propagating executables.
I've always found it fascinating that the human immune system has both proactive and reactive security, just like our computers should. The innate immune system [1] is analogous to mandatory access control, OS file permissions, buffer hardening, and other non-specific security mechanisms. The adaptive immune system, on the other hand, works like a blacklist updated throughout your life (and propagated from mother to child!).
Both systems catch threats the other does not. There's still a lot to learn from biology.
[1] https://en.wikipedia.org/wiki/Innate_immune_system [2] https://en.wikipedia.org/wiki/Adaptive_immune_system
Re: Bypassing Antivirus with Ten Lines of Code
#30I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…
Neat, but most people will just click "yes." See Windows Vista.
That's what happens when the answer is "yes" 99.9999% of the time. Have you ever seen a case where "no" is appropriate?